fixed user edit/view privileges